0

I will be publishing an Android application for a client in the coming weeks and need to look at how to secure the app

At the moment I am currently running Proguard

I am not concerned about the resources (xml, images) what I need to protect is the source.

Apart from Proguard is there anything else I can do?

Thanks B

user964283
  • 853
  • 4
  • 11
  • 16

3 Answers3

1

there are tools to disassemble your apk file. Proguard is a must-have, however, it doesn't mean absolute security. The proguard just makes the decompiled codes not as readable as the source codes, so it needs much more time and patience to analyse the codes. Basically, it's enough, if you concern a higher security, I suggest:

write your core algorithm in C, and call it via JNI.

encrypt your sensitive data or not store it locally.

break down your methods into fragments , to make it more difficulty to read after decompilation.

Huang
  • 4,812
  • 3
  • 21
  • 20
0

When you build an Android app, the Java sources (.java files) are compiled into byte code (.class files). It is the class files that become part of the final app .apk file; the source .java files are not included.

mharper
  • 3,212
  • 1
  • 23
  • 23
0

The apk is built using a fairly complex process. First the java files are compiled to class files and then the class files are fed into a dex compiler to create code for the dalvik machine. So even if you use a de-dexer to decompile the apk, It is very unlikely anyone can ever read your actual source code :)

However you use pro-guard as well to further obfuscate your code. I dont think there are better tools than pro guard that can be used

Pavan K
  • 4,085
  • 8
  • 41
  • 72
  • it is not so hard for a developer to do reverse engineering using below instruction, also please note that there are several tools available for this! [Getting source code from an APK file](http://stackoverflow.com/questions/3593420/android-getting-source-code-from-an-apk-file) – VSB Aug 06 '13 at 12:12
  • @VSB have you used any of those tools to decompile a production version of apk like facebook or say something for which source is available like firefox. Please let me know your experience. I have used most of them and though they can give fairly the package names or so, decompiling the source is extremely buggy. Try using them you will know what I am talking about. – Pavan K Aug 08 '13 at 10:26